CVE-2026-40308: joedolson my-calendar

Vulnerability summary

CVE-2026-40308 is a high (CVSS 8.8) vulnerability in joedolson my-calendar. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.2% of scored vulnerabilities. Fixed in 3.7.7.

Timeline

1. 16-04-2026
   PublishedVulnerability first disclosed.
2. 17-04-2026
   Last modifiedVulnerability information updated.

Description

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.